Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HAProxy is not affected by the HTTP/2 Rapid Reset Attack

haproxy.com

Post reply on HN
Print view View original

31–36 of 36 posts

Re: HAProxy is not affected by the HTTP/2 Rapid Reset Attack

#31

Post by tpmx »

xiasongh wrote: post #30
chaps wrote: post #18

Earlier quoted context omitted.

Agreed. Haproxy is an absolute wonder compared to similar systems. It all just feels so much cleaner, thought out, and built from the ground up for many different use cases. It very much has a feel that reminds me a lot of the spirit of sqlite.

What about nginx? I'm not too familiar but I was under the impression that it was the safe choice

It's primary focus is/was being a web server - a faster Apache. This shows.

Also (after the acqusition by F5 in 2019?) more features are kept away from the open source version compared to HAProxy.

Re: HAProxy is not affected by the HTTP/2 Rapid Reset Attack

#32

Post by tpmx »

exabrial wrote: post #22
tpmx wrote: post #5

I'm quite impressed with HAProxy. It takes a little effort to fully understand the configuration file format (hint: you've got to read the documentation, not just look at examples to fully grok it), but it's so worth it, IMO. It's also a nice treat to have the founder and technical leader (Willy Tarreau) of the HAProxy company being so active in the community, so many years later (the initital release was in 2001). I…

It's become my swiss army knife of TCP. I nearly always terminate TCP first with haproxy "out of process" of whatever, then have it proxy over a unix socket to "whatever". This allows an immense amount of flexibility, from being able to "wiretap" whats going on in the real world, to default error pages, alarms, monitoring, handling CORS... tons of uses.

Please write a blog post about this and submit it to HN!

Re: HAProxy is not affected by the HTTP/2 Rapid Reset Attack

#34

Post by nickramirez »

frankjr wrote: post #29
superq wrote: post #27

Earlier quoted context omitted.

Caddy is a bit quick and dirty, rapidly-developing, with neat plugins but hard to configure for more complex scenarios and too light on the docs (IMO). HA Proxy is robust, comprehensive, mature, and bulletproof. It's basically boring because it works so well. If you have to choose only one to learn, choose HA Proxy.

I wanted to try it out just now but hit a roadblock immediately - it cannot automatically obtain and maintain TLS certificates. You have to use an external client (e.g. acme.sh), set up a cron to check/renew them, and poke HAProxy to reload them if necessary. I'm way past doing this in 2023. https://www.haproxy.com/blog/haproxy-and-let-s-encrypt https://github.com/haproxy/haproxy/issues/1864

If getting Let's Encrypt to work with HAProxy is your only struggle, you'll soon overcome it and be loving HAProxy. And there are multiple ways to set up Let's Encrypt, if you don't want to use acme.sh. For example, you could use certbot. There are blog posts that cover that pretty well.

Re: HAProxy is not affected by the HTTP/2 Rapid Reset Attack

#35

Post by bkallus »

tpmx wrote: post #5

I'm quite impressed with HAProxy. It takes a little effort to fully understand the configuration file format (hint: you've got to read the documentation, not just look at examples to fully grok it), but it's so worth it, IMO. It's also a nice treat to have the founder and technical leader (Willy Tarreau) of the HAProxy company being so active in the community, so many years later (the initital release was in 2001). I…

I had the privilege of reporting a few bugs in HAProxy in the last few months. Willy's a real treasure; he's friendly and knowledgeable, and he clearly cares a ton about HAProxy even after 22 years of development.

Re: HAProxy is not affected by the HTTP/2 Rapid Reset Attack

#36

Post by superq »

frankjr wrote: post #29
superq wrote: post #27

Earlier quoted context omitted.

Caddy is a bit quick and dirty, rapidly-developing, with neat plugins but hard to configure for more complex scenarios and too light on the docs (IMO). HA Proxy is robust, comprehensive, mature, and bulletproof. It's basically boring because it works so well. If you have to choose only one to learn, choose HA Proxy.

I wanted to try it out just now but hit a roadblock immediately - it cannot automatically obtain and maintain TLS certificates. You have to use an external client (e.g. acme.sh), set up a cron to check/renew them, and poke HAProxy to reload them if necessary. I'm way past doing this in 2023. https://www.haproxy.com/blog/haproxy-and-let-s-encrypt https://github.com/haproxy/haproxy/issues/1864

you may wish to use certbot instead:

https://github.com/acmesh-official/acme.sh/issues/4659

Post reply on HN